Bump dependent image digests

[inFocus7]

Context

Part of a workstream to reduce CVEs in kagent and dependencies.

Bumps the third-party image pins in the Helm chart and the rendered manifests, and turns the RustFS bucket-init Job into a Helm hook so the chart can be upgraded (Jobs are immutable, and without the hook it caused failures on upgrade).

Image	Before	After
postgres	18.4 on Alpine 3.24 (digest built 2026-07-07)	18.6 on Alpine 3.24
rustfs	1.0.0-beta.3	v1.0.0-rc.5
amazon/aws-cli	2.17.0 (Amazon Linux 2, EOL)	2.36.43 (Amazon Linux 2023)

Why the bucket-init Job becomes a hook

A Job's pod template is immutable. The chart's rustfs-bucket-init was a plain release resource, so any helm upgrade that changes its image fails with cannot patch "rustfs-bucket-init" with kind Job ... field is immutable. This PR is the first change to trip that (assuming by this not being in place before), but any future edit to the Job would have too.

Verification

Image-level checks (Docker, arm64):

• All new digests are multi-arch indexes with amd64 and arm64 children and match their tags.
• PostgreSQL 18.4 data directory started under 18.6 with data intact.
  • The 18.6 notes require no dump/restore, and its post-update items (GIN, btree_gist, tree, logical decoding plugins, pgcrypto) are not used by our schema.
• RustFS beta.3 data directory started under rc.5 with the chart's exact env, including default credentials on a single node; bucket, small and 12 MB multipart objects readable with matching checksums.
• aws-cli 2.36.43 defaults to CRC64NVME trailing checksums (since 2.23.0); verified head-bucket, create-bucket, and 12 MB streaming multipart uploads against both RustFS versions.

Local Helm upgrade rehearsal (fresh kind cluster, gVisor, arm64):

1. Installed the published 0.0.26 chart with its released images, deployed the counter demo from the v0.0.26 tag, created an actor, called it three times, suspended it. The bucket held the golden snapshot and the actor's snapshot.
2. Upgraded directly to this chart in one helm upgrade. The first attempt succeeded with no manual Job deletion, the hook Job ran with the new aws-cli image, RustFS rc.5 and Postgres 18.6 rolled with all pre-upgrade objects and tables intact, a no-op upgrade re-ran the hook idempotently, and TestActorLifecycle / TestActorSnapshotLifecycle passed on the upgraded cluster.

Not verified

• helm rollback to a pre-hook revision probably needs the Job deleted first; not tested.

CVEs

Before (current main / v0.0.26 pins) → After (this PR)

pin	before	High+	Crit	after	High+	Crit
rustfs	1.0.0-beta.3	97	26	v1.0.0-rc.5	0	0
awsCli	2.17.0	136	1	2.36.43	3	0
postgres	18-alpine (18.4)	112	9	18.6-alpine3.24 (18.6)	93	9
busybox	1.36	1	1	1.38.0	3	0
total		346	37		99	9

346 → 99 High+ (−247), 37 → 9 Critical (−28).

Fixes #<issue_number_goes_here>

• Tests pass
• Appropriate changes to documentation are included in the PR